> For the complete documentation index, see [llms.txt](https://docs.vida.id/identity-stack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vida.id/identity-stack/authentication/authentication-factors/cryptographic-token-pki/integration-methods/api/verify-signature.md).

# Verify Signature

This API endpoint allows you to verify the integrity of a signature by comparing it to a message hash using the specified credential ID and presence key (silent key or presence key). The response returns a success status if the signature matches the message hash.

## API  Description

## API to verify signature

<mark style="color:green;">`POST`</mark> `https://{{environment_url}}/api/v1/device/verify`

#### Headers

| Name                                            | Type   | Description                                                    |
| ----------------------------------------------- | ------ | -------------------------------------------------------------- |
| Content-Type<mark style="color:red;">\*</mark>  |        | <p>Format type of request body<br>Value : application/json</p> |
| accept<mark style="color:red;">\*</mark>        | String | \*/\*                                                          |
| Authorization<mark style="color:red;">\*</mark> | String | Bearer \<Token>                                                |

#### Request Body

| Name                                             | Type   | Description                                                                            |
| ------------------------------------------------ | ------ | -------------------------------------------------------------------------------------- |
| credential\_id<mark style="color:red;">\*</mark> | String | registered credential id                                                               |
| presence<mark style="color:red;">\*</mark>       | String | SILENT\_USER - Check with silent key ENFORCE\_USER\_PRESENCE - Check with presence key |
| message\_hash<mark style="color:red;">\*</mark>  | String | Hash of the message that has been signed                                               |
| signed\_data<mark style="color:red;">\*</mark>   | String | Signature of message hash                                                              |

#### API Response

### Verify Signature Request Successful

If the signature derived from the hash of the message matches, success is returned in as status in response.

HTTP Status Code: `200`

**JSON Response**

```json
{
    "status": "success"
}
```

### Integration Code Snippets

{% tabs %}
{% tab title="Curl" %}

```groovy
curl -X 'POST' \
'http://{{environment_url}}/api/v1/device/verify'\
-H 'accept: */*' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer <bearer token>' \
-d '{
"credential_id": "bbdcfd28-0e58-11ed-861d-0242ac120002",
"presence": "SILENT_USER",
"message_hash" : "test",
"signed_data" : "MEUCIGkP8ccfLee"
}'
```

{% endtab %}
{% endtabs %}

### Signature verification at the partner server&#x20;

The public keys from VIDA API can be obtained with the call [fetch-public-key](/identity-stack/authentication/authentication-factors/cryptographic-token-pki/integration-methods/api/fetch-public-keys.md). This endpoint will return keys in `base64` format. `X509EncodedKeySpec` must be used to create a `PublicKey` structure.

{% tabs %}
{% tab title="JAVA" %}

```java
public static PublicKey generatePublicKeyFromString(String keyValue) {
    try {
        final EncodedKeySpec publicKeySpec = new X509EncodedKeySpec(Base64.getDecoder().decode(keyValue));
        final KeyFactory keyFactory = KeyFactory.getInstance("EC");
        return keyFactory.generatePublic(publicKeySpec);
    } catch (NoSuchAlgorithmException |
        InvalidKeySpecException IllegalArgumentException e) 
        {
        throw new BusinessException(format("Could not generate PublicKey for: %s", keyValue), e);
}
```

{% endtab %}
{% endtabs %}

If the key generation succeeds, we can verify the signature and message hash with the `PublicKey` instance. The `messageHash` should not have encapsulating whitespaces.

{% tabs %}
{% tab title="JAVA" %}

```java
public static boolean validateSignature(
PublicKey publicKey,
String signature,
String messageHash) {
    try {
        final Signature ecdsaVerify = Signature.getInstance("SHA256withECDSA");
        ecdsaVerify.initVerify(publicKey);
        ecdsaVerify.update(messageHash.getBytes(UTF_8));
        return ecdsaVerify.verify(Base64.getDecoder().decode(signature));
    } catch (NoSuchAlgorithmException | SignatureException |
        InvalidKeyException |
        IllegalArgumentException e) 
        {
            throw new BusinessException("Could not validate signature", e);
        }
}
```

{% endtab %}
{% endtabs %}